react-native-audio-browser 0.2.0-next.1 → 0.2.0-next.11

package/android/src/main/java/com/audiobrowser/tls/CachingCertificateFetcher.kt

@@ -2,39 +2,75 @@ package com.audiobrowser.tls
 
 import java.io.ByteArrayInputStream
 import java.io.ByteArrayOutputStream
+import java.io.InputStream
 import java.net.InetSocketAddress
 import java.net.Socket
 import java.net.URL
 import java.security.cert.CertificateFactory
 import java.security.cert.X509Certificate
-import java.util.concurrent.ConcurrentHashMap
+import java.util.concurrent.atomic.AtomicBoolean
 import javax.net.ssl.HttpsURLConnection
 import javax.net.ssl.SSLContext
+import javax.net.ssl.SSLSocket
 import javax.net.ssl.SSLSocketFactory
+import kotlin.concurrent.thread
 import timber.log.Timber
 
 /**
  * Fetches and caches issuer certificates from AIA "CA Issuers" URLs. Used by
  * [AiaChasingTrustManager] to fill in intermediates a server failed to send.
  *
- * Runs on the TLS handshake thread, so it uses short timeouts and never throws — a failed or slow
- * fetch resolves to an empty list (the handshake then fails exactly as it would have without AIA
- * chasing). Only non-empty results are cached, so the (typically `http`) round-trip happens at most
- * once per intermediate for the process lifetime while transient failures stay retryable.
+ * Runs on the TLS handshake thread, so it is bounded on every axis and never throws — a failed,
+ * oversized or slow fetch resolves to an empty list, and the handshake then fails exactly as it
+ * would have without AIA chasing. Every input here is chosen by a server we are already failing to
+ * validate: the AIA extension names the host, port and path, and then that host chooses the
+ * response. So:
+ * - the URL is rejected unless it is free of control characters ([isSafeUrl]),
+ * - a response is capped at [MAX_RESPONSE_BYTES] and [MAX_RESPONSE_MILLIS],
+ * - at most [MAX_REDIRECTS] redirects are followed,
+ * - the cache holds at most [MAX_CACHE_ENTRIES], and only successful fetches, so a round trip
+ *   happens at most once per intermediate while transient failures stay retryable,
+ * - the whole call — every connect, handshake, read and redirect hop — ends at the caller's
+ *   `deadlineNanos`: each per-operation timeout is clipped to the time remaining, connect and read
+ *   by their socket timeouts and the TLS handshake plus the exchange by a watchdog that closes the
+ *   underlying transport, and once the deadline has passed nothing further is even started.
  *
- * `http` fetches go over a raw [Socket] rather than `HttpURLConnection`. CA "CA Issuers" URLs are
- * virtually always plain `http` (the CA/Browser Forum Baseline Requirements mandate it, to avoid a
- * chicken-and-egg TLS dependency when fetching the cert needed to complete a TLS chain), but
- * Android blocks cleartext `HttpURLConnection` traffic by default on apps targeting API 28+. A raw
- * socket is not subject to `NetworkSecurityPolicy`, so the fetch succeeds regardless of the host
- * app's cleartext setting — safely, because the fetched certificate is still cryptographically
- * verified to be the real issuer before [AiaChasingTrustManager] trusts it.
+ * The one step no deadline reaches is DNS: `InetSocketAddress` resolves synchronously and Java
+ * exposes no timeout for it, so a lookup begun just inside the deadline can overrun it by its own
+ * duration. A lookup is never *started* past the deadline, and [AiaCertChaser.MAX_URLS_PER_CERT]
+ * keeps the count down — a certificate can only make us resolve a few names, not a few hundred.
+ *
+ * Both schemes go over a raw [Socket] rather than `HttpURLConnection`. For `http` that is because
+ * CA "CA Issuers" URLs are virtually always plain `http` — the CA/Browser Forum Baseline
+ * Requirements mandate it, to avoid a chicken-and-egg TLS dependency when fetching the certificate
+ * needed to complete a TLS chain — while Android blocks cleartext `HttpURLConnection` traffic by
+ * default on apps targeting API 28+. A raw socket is not subject to `NetworkSecurityPolicy`, so the
+ * fetch succeeds regardless of the host app's cleartext setting; safely, because the fetched
+ * certificate is still cryptographically verified to be the real issuer before
+ * [AiaChasingTrustManager] trusts it.
+ *
+ * For `https` it is because `HttpURLConnection.getInputStream()` performs the connect, request and
+ * response *headers* before returning a stream, so a read cap applied to that stream bounds only
+ * the body: a server dripping header bytes just inside the per-read timeout would hold the
+ * handshake thread for as long as it liked. Reading the headers ourselves puts them inside the same
+ * budget as the body. It also keeps one redirect policy — the platform stack would otherwise follow
+ * its own, ignoring [MAX_REDIRECTS].
  */
 class CachingCertificateFetcher(
   private val connectTimeoutMs: Int = 5_000,
   private val readTimeoutMs: Int = 5_000,
+  private val nowNanos: () -> Long = System::nanoTime,
 ) {
-  private val cache = ConcurrentHashMap<String, List<X509Certificate>>()
+  /**
+   * Bounded, least-recently-used. An attacker can name any URL and serve any parseable certificate
+   * from it, so an unbounded map would retain a megabyte per hostile handshake for the process
+   * lifetime. A real app needs a handful of intermediates.
+   */
+  private val cache =
+    object : LinkedHashMap<String, List<X509Certificate>>(16, 0.75f, true) {
+      override fun removeEldestEntry(eldest: Map.Entry<String, List<X509Certificate>>) =
+        size > MAX_CACHE_ENTRIES
+    }
 
   /**
    * A plain system-default socket factory for `https` AIA fetches. Without it the fetch would use
@@ -45,80 +81,230 @@ class CachingCertificateFetcher(
     SSLContext.getInstance("TLS").apply { init(null, null, null) }.socketFactory
   }
 
-  fun fetch(url: String): List<X509Certificate> {
-    cache[url]?.let {
-      return it
-    }
-    val certs = download(url)?.let { parseCertificates(it) }.orEmpty()
-    if (certs.isNotEmpty()) cache[url] = certs
+  /**
+   * Fetches the certificates served at [url], giving up no later than [deadlineNanos] — absolute,
+   * on [nowNanos]'s origin. [AiaCertChaser.completeChain] passes its whole-walk deadline here, so
+   * one budget bounds the sum of every fetch it makes. The default covers a standalone call.
+   *
+   * A cache hit is answered even past the deadline — it costs no I/O.
+   */
+  fun fetch(
+    url: String,
+    deadlineNanos: Long = nowNanos() + AiaCertChaser.MAX_CHASE_MILLIS * 1_000_000,
+  ): List<X509Certificate> {
+    synchronized(cache) { cache[url] }
+      ?.let {
+        return it
+      }
+    val certs = download(url, deadlineNanos)?.let { parseCertificates(it) }.orEmpty()
+    if (certs.isNotEmpty()) synchronized(cache) { cache[url] = certs }
     return certs
   }
 
-  private fun download(url: String, redirectsLeft: Int = MAX_REDIRECTS): ByteArray? =
+  /** Milliseconds until [deadlineNanos]; zero or negative once it has passed. */
+  private fun remainingMs(deadlineNanos: Long): Long = (deadlineNanos - nowNanos()) / 1_000_000
+
+  private fun download(
+    url: String,
+    deadlineNanos: Long,
+    redirectsLeft: Int = MAX_REDIRECTS,
+  ): ByteArray? =
     try {
+      // Checked before anything is started — DNS included, since it is the one step below that
+      // no timeout reaches. Redirects recurse through here, so every hop re-checks.
+      require(remainingMs(deadlineNanos) > 0) { "AIA chase budget exhausted" }
+      require(isSafeUrl(url)) { "AIA URL contains characters that are not valid in a URL" }
       val parsed = URL(url)
       when (parsed.protocol) {
-        "http" -> downloadCleartext(parsed, redirectsLeft)
-        "https" -> downloadHttps(parsed)
-        else -> null // restrict to http/https — file:, ftp: etc. are never valid CA-issuer sources
+        // restrict to http/https — file:, ftp: etc. are never valid CA-issuer sources
+        "http" -> fetchOverSocket(parsed, deadlineNanos, redirectsLeft, secure = false)
+        "https" -> fetchOverSocket(parsed, deadlineNanos, redirectsLeft, secure = true)
+        else -> null
       }
     } catch (e: Exception) {
-      Timber.w(e, "AIA CA-issuer fetch failed: %s", url)
+      // The URL is attacker-supplied text and this is the one place it survives the safety
+      // check, so it is escaped rather than handed to the log verbatim.
+      Timber.w(e, "AIA CA-issuer fetch failed: %s", sanitizeForLog(url))
       null
     }
 
   /**
-   * `https` AIA fetch over the platform HTTP stack. `https` is never subject to Android's cleartext
-   * policy, so `HttpsURLConnection` is fine here; the plain socket factory keeps the fetch's own
-   * handshake from recursing into AIA chasing.
+   * A connected socket to speak HTTP over, plus the plain TCP transport underneath it. They differ
+   * for `https`: closing an `SSLSocket` writes a `close_notify` alert, which can itself block
+   * against a peer that stopped reading — so anything that needs to *unblock* a stalled call must
+   * close [transport], whose close is immediate and fails every read layered above it.
    */
-  private fun downloadHttps(url: URL): ByteArray? {
-    val connection = url.openConnection() as? HttpsURLConnection ?: return null
-    connection.connectTimeout = connectTimeoutMs
-    connection.readTimeout = readTimeoutMs
-    connection.sslSocketFactory = plainSslSocketFactory
-    return connection.inputStream.use { it.readBytes() }
-  }
+  private class Connection(val socket: Socket, val transport: Socket)
 
-  /**
-   * `http` AIA fetch over a raw socket — see the class doc for why this bypasses
-   * `HttpURLConnection`.
-   */
-  private fun downloadCleartext(url: URL, redirectsLeft: Int): ByteArray? {
+  /** One HTTP/1.0 exchange over a socket, TLS-wrapped when [secure], then redirects. */
+  private fun fetchOverSocket(
+    url: URL,
+    deadlineNanos: Long,
+    redirectsLeft: Int,
+    secure: Boolean,
+  ): ByteArray? {
     val host = url.host
-    val port = if (url.port != -1) url.port else 80
+    val port = if (url.port != -1) url.port else if (secure) 443 else 80
     val path = url.file.ifEmpty { "/" } // URL.file is path + query
+    val connection = connect(host, port, secure, deadlineNanos)
     val raw =
-      Socket().use { socket ->
-        socket.connect(InetSocketAddress(host, port), connectTimeoutMs)
-        socket.soTimeout = readTimeoutMs
-        // HTTP/1.0 + `Connection: close` so the server closes after the body and we can read to EOF
-        // without parsing Content-Length.
-        val request =
-          "GET $path HTTP/1.0\r\n" +
-            "Host: $host\r\n" +
-            "Connection: close\r\n" +
-            "User-Agent: react-native-audio-browser\r\n" +
-            "Accept: */*\r\n\r\n"
-        socket.getOutputStream().apply {
-          write(request.toByteArray(Charsets.ISO_8859_1))
-          flush()
+      try {
+        withWatchdog(
+          minOf(remainingMs(deadlineNanos), connectTimeoutMs + MAX_RESPONSE_MILLIS),
+          abort = { connection.transport.close() },
+        ) {
+          val socket = connection.socket
+          socket.soTimeout = timeoutMs(deadlineNanos, readTimeoutMs)
+          // HTTP/1.0 + `Connection: close` so the server closes after the body and we can read
+          // to EOF without parsing Content-Length. A non-default port belongs in Host, or a
+          // name-based virtual host answers for the wrong site.
+          val hostHeader = if (port == (if (secure) 443 else 80)) host else "$host:$port"
+          val request =
+            "GET $path HTTP/1.0\r\n" +
+              "Host: $hostHeader\r\n" +
+              "Connection: close\r\n" +
+              "User-Agent: react-native-audio-browser\r\n" +
+              "Accept: */*\r\n\r\n"
+          socket.getOutputStream().apply {
+            write(request.toByteArray(Charsets.ISO_8859_1))
+            flush()
+          }
+          socket.getInputStream().use {
+            readCapped(
+              it,
+              budgetMs = minOf(remainingMs(deadlineNanos), MAX_RESPONSE_MILLIS),
+              nowNanos = nowNanos,
+            )
+          }
         }
-        socket.getInputStream().use { it.readBytes() }
-      }
+      } finally {
+        // Transport first: its close never blocks and unblocks anything above it, so the
+        // SSLSocket's close_notify attempt afterwards fails fast instead of stalling.
+        runCatching { connection.transport.close() }
+        runCatching { connection.socket.close() }
+      } ?: return null
     val response = parseHttpResponse(raw) ?: return null
     return when {
       response.status in 200..299 -> response.body
       response.status in 300..399 && response.location != null && redirectsLeft > 0 ->
-        // Follow CA-issuer redirects (rare). A redirect to `https` falls through to the https path.
-        download(URL(url, response.location).toString(), redirectsLeft - 1)
+        // Follow CA-issuer redirects (rare). `download` is the recursion point, so the target
+        // goes through the same URL check and the same deadline.
+        download(URL(url, response.location).toString(), deadlineNanos, redirectsLeft - 1)
       else -> null
     }
   }
 
+  /**
+   * Connects to [host]:[port], wrapping in TLS when [secure]. Both the connect and the TLS
+   * handshake are clipped to the caller's deadline.
+   *
+   * The TLS socket verifies the hostname explicitly. A raw `SSLSocket` does not do it on its own,
+   * and `SSLParameters.setEndpointIdentificationAlgorithm` is API 24+, so the platform's default
+   * verifier is applied against the negotiated session instead — which works on every supported
+   * level and is the same check `HttpsURLConnection` would have made.
+   */
+  private fun connect(host: String, port: Int, secure: Boolean, deadlineNanos: Long): Connection {
+    val plain = Socket()
+    // Everything from here on closes `plain` if it throws. Android's Socket.connect, unlike
+    // modern OpenJDK's, does not close itself on failure once the descriptor is allocated, so
+    // every unreachable AIA host would otherwise leak one until finalization.
+    var wrapper: SSLSocket? = null
+    return try {
+      plain.connect(InetSocketAddress(host, port), timeoutMs(deadlineNanos, connectTimeoutMs))
+      if (!secure) return Connection(plain, plain)
+      // The handshake is bounded by a watchdog, not by soTimeout: soTimeout is per-read, so a
+      // server drip-feeding handshake bytes would stretch it indefinitely. The watchdog closes
+      // `plain`, the transport — closing the SSLSocket instead would write a close_notify that
+      // can block against the very peer that caused the stall.
+      withWatchdog(
+        minOf(remainingMs(deadlineNanos), connectTimeoutMs + MAX_RESPONSE_MILLIS),
+        abort = { plain.close() },
+      ) {
+        val ssl = plainSslSocketFactory.createSocket(plain, host, port, true) as SSLSocket
+        wrapper = ssl
+        ssl.soTimeout = timeoutMs(deadlineNanos, readTimeoutMs)
+        ssl.startHandshake()
+        require(HttpsURLConnection.getDefaultHostnameVerifier().verify(host, ssl.session)) {
+          "AIA host $host does not match its certificate"
+        }
+        Connection(ssl, plain)
+      }
+    } catch (e: Exception) {
+      runCatching { plain.close() }
+      // The orphaned TLS wrapper too — with the transport already gone its close_notify attempt
+      // fails fast, and this releases the wrapper's own buffers rather than waiting on the GC.
+      runCatching { wrapper?.close() }
+      throw e
+    }
+  }
+
+  /**
+   * A per-operation socket timeout: [perOperationMs] clipped to the deadline, and never 0 ("no
+   * timeout" to a socket) — an already-expired deadline still gets a 1 ms timeout and fails at
+   * once.
+   */
+  private fun timeoutMs(deadlineNanos: Long, perOperationMs: Int): Int =
+    minOf(remainingMs(deadlineNanos), perOperationMs.toLong())
+      .coerceIn(1, Int.MAX_VALUE.toLong())
+      .toInt()
+
+  /**
+   * Runs [body] with a watchdog thread that invokes [abort] once [budgetMs] elapses — unless the
+   * body has already finished, which the done flag makes visible to a watchdog waking at just that
+   * moment, so a successful exchange cannot have its socket closed out from under it.
+   *
+   * The socket timeouts are per-operation and so cannot bound a peer that keeps every individual
+   * read just inside them; [abort] — closing the underlying transport — is what actually ends a
+   * stalled handshake or exchange: the blocked call throws, and a failed fetch is already handled
+   * as "no AIA".
+   */
+  private inline fun <T> withWatchdog(
+    budgetMs: Long,
+    crossinline abort: () -> Unit,
+    body: () -> T,
+  ): T {
+    val done = AtomicBoolean(false)
+    val watchdog =
+      thread(isDaemon = true, name = "aia-fetch-watchdog") {
+        runCatching { Thread.sleep(budgetMs.coerceAtLeast(0)) }
+          .onSuccess { if (!done.get()) runCatching { abort() } }
+      }
+    try {
+      return body()
+    } finally {
+      done.set(true)
+      watchdog.interrupt()
+    }
+  }
+
   companion object {
     private const val MAX_REDIRECTS = 5
 
+    /** Ceiling on how many fetched issuer certificates are retained. */
+    const val MAX_CACHE_ENTRIES = 32
+
+    /** Ceiling on a single AIA response, headers included. */
+    const val MAX_RESPONSE_BYTES = 1 shl 20 // 1 MiB
+
+    /** Ceiling on the wall-clock time spent reading one AIA response. */
+    const val MAX_RESPONSE_MILLIS = 10_000L
+
+    /**
+     * Whether [url] is free of characters that have no business in a URL.
+     *
+     * The fetch writes the path into a request line on a raw socket, and the URL is an IA5String
+     * copied verbatim out of a certificate a hostile server presented. `java.net.URL` preserves
+     * control characters — `URL("http://host:6379/\r\nSET foo bar")` parses to that host and port
+     * with the CRLF intact in `file` — so without this check a certificate could inject request
+     * lines of its own, to any host and port the device can reach. Space is excluded too: it would
+     * split the request line's target from its HTTP version.
+     */
+    fun isSafeUrl(url: String): Boolean = url.none { it.code <= 0x20 || it.code == 0x7F }
+
+    /** [text] with anything non-printable replaced, so a log line cannot be forged. */
+    fun sanitizeForLog(text: String): String =
+      text.map { if (it.code <= 0x20 || it.code == 0x7F) '?' else it }.joinToString("")
+
     /**
      * Parses every certificate from the bytes a CA-Issuers URL serves — a single DER certificate
      * (e.g. Let's Encrypt), a PEM file, or a PKCS#7 "certs-only" bundle. Empty if the bytes are not
@@ -133,6 +319,37 @@ class CachingCertificateFetcher(
         emptyList()
       }
 
+    /**
+     * Reads [input] to EOF, or returns null once it exceeds [limit] bytes or [budgetMs] of
+     * wall-clock time. Null rather than a truncated buffer: a cut-off certificate is not parseable
+     * anyway, and "too big" or "too slow" is a failed fetch, which the caller already knows how to
+     * treat as "no AIA".
+     *
+     * The byte cap alone would not bound the time. The socket's timeout is per-read, so a server
+     * returning one byte just inside it resets the clock on every iteration and holds the handshake
+     * thread for as long as it likes — a slow-drip stall in place of the unbounded buffer. Both
+     * limits are needed, and the deadline is checked against [nowNanos] (injectable so a test need
+     * not actually wait).
+     */
+    fun readCapped(
+      input: InputStream,
+      limit: Int = MAX_RESPONSE_BYTES,
+      budgetMs: Long = MAX_RESPONSE_MILLIS,
+      nowNanos: () -> Long = System::nanoTime,
+    ): ByteArray? {
+      val deadline = nowNanos() + budgetMs * 1_000_000
+      val out = ByteArrayOutputStream()
+      val chunk = ByteArray(8 * 1024)
+      while (true) {
+        val read = input.read(chunk)
+        if (read < 0) return out.toByteArray()
+        if (out.size() + read > limit) return null
+        out.write(chunk, 0, read)
+        // Subtraction, not `>`: overflow-safe across nanoTime's arbitrary origin.
+        if (nowNanos() - deadline >= 0) return null
+      }
+    }
+
     /** Status code, `Location` header (if any), and decoded body of a raw HTTP response. */
     data class HttpResponse(val status: Int, val location: String?, val body: ByteArray)
 
@@ -175,7 +392,9 @@ class CachingCertificateFetcher(
             .substringBefore(';')
             .trim()
             .toIntOrNull(16) ?: break
-        if (size == 0) break // last chunk
+        // `<= 0`, not `== 0`: toIntOrNull accepts a leading `-`, and a negative size would move
+        // `pos` backwards — the same rewinding-cursor loop the DER reader had.
+        if (size <= 0) break // last chunk, or malformed
         val dataStart = eol + 2
         if (dataStart + size > body.size) break
         out.write(body, dataStart, size)

package/android/src/main/java/com/audiobrowser/util/ArtworkVariant.kt

@@ -5,11 +5,10 @@ import com.margelo.nitro.audiobrowser.Variant_String_ArtworkVariants
 /**
  * Reading `Track.artwork`, which is either one URL or a URL per appearance.
  *
- * Android Auto is dark-only, so there is nothing here to choose: a pair always
- * resolves to its dark URL, which is also what a single-URL track would have
- * shipped. The per-appearance half of the feature is iOS/CarPlay only — see
- * `ios/Extension/Variant+Artwork.swift`, where both URLs are kept so a
- * `UIImageAsset` can swap them without a re-fetch.
+ * Android Auto is dark-only, so there is nothing here to choose: a pair always resolves to its dark
+ * URL, which is also what a single-URL track would have shipped. The per-appearance half of the
+ * feature is iOS/CarPlay only — see `ios/Extension/Variant+Artwork.swift`, where both URLs are kept
+ * so a `UIImageAsset` can swap them without a re-fetch.
  */
 val Variant_String_ArtworkVariants.url: String
   get() = match(first = { it }, second = { it.dark })
@@ -17,10 +16,9 @@ val Variant_String_ArtworkVariants.url: String
 /**
  * Wraps a plain URL as the single-URL side of the union.
  *
- * For the places that build a `Track` from something that only ever has one
- * image — restored persistence, a `MediaMetadata` handed back by the platform.
- * Restoring collapses a pair to its dark URL, which costs nothing here: Android
- * Auto would have rendered that one anyway.
+ * For the places that build a `Track` from something that only ever has one image — restored
+ * persistence, a `MediaMetadata` handed back by the platform. Restoring collapses a pair to its
+ * dark URL, which costs nothing here: Android Auto would have rendered that one anyway.
  */
 fun artworkOf(url: String?): Variant_String_ArtworkVariants? =
   url?.let { Variant_String_ArtworkVariants.First(it) }

package/android/src/main/java/com/audiobrowser/util/TrackFactory.kt

@@ -26,12 +26,12 @@ object TrackFactory {
   }
 
   /**
-   * Android Auto has no image-row rendering; its closest equivalent is a grid of artwork
-   * tiles. A track carrying `imageRow` expands into its items as grid-styled rows (the
-   * per-item content-style hint — hosts that ignore it fall back to list rows) grouped under
-   * the row's title, followed by the row itself as a browsable "view all" link when it has a
-   * `url` (a url-less row is a pure preview and contributes only its items). Tracks without
-   * an `imageRow` pass through unchanged.
+   * Android Auto has no image-row rendering; its closest equivalent is a grid of artwork tiles. A
+   * track carrying `imageRow` expands into its items as grid-styled rows (the per-item
+   * content-style hint — hosts that ignore it fall back to list rows) grouped under the row's
+   * title, followed by the row itself as a browsable "view all" link when it has a `url` (a
+   * url-less row is a pure preview and contributes only its items). Tracks without an `imageRow`
+   * pass through unchanged.
    */
   fun expandImageRows(tracks: List<Track>): List<Track> =
     tracks.flatMap { track ->
@@ -95,7 +95,8 @@ object TrackFactory {
     val scheme = rawUrl?.let { Uri.parse(it).scheme?.lowercase() }
     val builder = metadataBuilder(track)
     if (rawUrl != null && (scheme == "http" || scheme == "https")) {
-      val isSvg = SvgArtworkRenderer.isSvgUrl(rawUrl) || SvgArtworkRenderer.isSvgUrl(track.artwork?.url)
+      val isSvg =
+        SvgArtworkRenderer.isSvgUrl(rawUrl) || SvgArtworkRenderer.isSvgUrl(track.artwork?.url)
       val token = ArtworkUris.tokenFor(rawUrl)
       registry.register(token, ResolvedArtwork(rawUrl, track.artworkSource?.headers, isSvg))
       builder.setArtworkUri(ArtworkUris.contentUri(authority, token).toUri())

package/android/src/test/java/com/audiobrowser/ServiceBindingTest.kt

@@ -0,0 +1,87 @@
+package com.audiobrowser
+
+import android.content.ComponentName
+import android.content.Intent
+import android.content.ServiceConnection
+import android.os.IBinder
+import org.junit.Assert.assertEquals
+import org.junit.Assert.assertFalse
+import org.junit.Assert.assertTrue
+import org.junit.Test
+import org.junit.runner.RunWith
+import org.robolectric.RobolectricTestRunner
+import org.robolectric.RuntimeEnvironment
+import org.robolectric.Shadows.shadowOf
+
+// Robolectric: bindService/unbindService only exist under the framework, and ShadowApplication
+// records both sides — which is precisely the leak being guarded against.
+@RunWith(RobolectricTestRunner::class)
+class ServiceBindingTest {
+
+  private val app = RuntimeEnvironment.getApplication()
+  private val intent = Intent(app, Service::class.java)
+
+  private val connection =
+    object : ServiceConnection {
+      override fun onServiceConnected(name: ComponentName?, service: IBinder?) = Unit
+
+      override fun onServiceDisconnected(name: ComponentName?) = Unit
+    }
+
+  /** Both the auto-bind at construction and setup's bind reach the same object. */
+  @Test
+  fun bindingTwiceTakesOnlyOneBinding() {
+    val binding = ServiceBinding(app)
+
+    assertTrue(binding.bind(intent, connection))
+    assertTrue(binding.bind(intent, connection))
+
+    assertEquals(1, shadowOf(app).boundServiceConnections.size)
+
+    binding.unbind(connection)
+
+    assertTrue(shadowOf(app).boundServiceConnections.isEmpty())
+    assertEquals(1, shadowOf(app).unboundServiceConnections.size)
+  }
+
+  /** dispose() must not throw, and Android throws when unbinding a connection it never had. */
+  @Test
+  fun unbindWithoutBindIsANoOp() {
+    val binding = ServiceBinding(app)
+
+    binding.unbind(connection)
+
+    assertFalse(binding.isBound)
+    assertTrue(shadowOf(app).unboundServiceConnections.isEmpty())
+  }
+
+  /**
+   * Android registers the connection before it asks the ActivityManager, so a false return still
+   * leaves a binding to release. Treating false as "nothing bound" strands it permanently — the
+   * leak this class exists to prevent.
+   */
+  @Test
+  fun failedBindStillHoldsAConnectionToRelease() {
+    val binding = ServiceBinding(app)
+    shadowOf(app).declareActionUnbindable("unbindable")
+
+    assertFalse(binding.bind(Intent("unbindable"), connection))
+
+    assertTrue(binding.isBound)
+
+    binding.unbind(connection)
+
+    assertEquals(1, shadowOf(app).unboundServiceConnections.size)
+  }
+
+  @Test
+  fun unbindIsIdempotent() {
+    val binding = ServiceBinding(app)
+    binding.bind(intent, connection)
+
+    binding.unbind(connection)
+    binding.unbind(connection)
+
+    assertEquals(1, shadowOf(app).unboundServiceConnections.size)
+  }
+}

package/android/src/test/java/com/audiobrowser/TestFixtures.kt

@@ -1,12 +1,13 @@
 package com.audiobrowser
 
 import com.audiobrowser.util.artworkOf
-
 import com.margelo.nitro.audiobrowser.ArtworkRequestConfig
 import com.margelo.nitro.audiobrowser.ImageQueryParams
 import com.margelo.nitro.audiobrowser.ImageRowItem
 import com.margelo.nitro.audiobrowser.ImageSource
 import com.margelo.nitro.audiobrowser.MediaRequestConfig
+import com.margelo.nitro.audiobrowser.NativeRouteEntry
+import com.margelo.nitro.audiobrowser.ResolvedTrack
 import com.margelo.nitro.audiobrowser.Track
 import com.margelo.nitro.audiobrowser.TransformableRequestConfig
 
@@ -142,6 +143,56 @@ object TestFixtures {
       imageRow = null,
     )
 
+  /** A container [ResolvedTrack] — what a browse route hands back for a path. */
+  fun resolvedTrack(
+    url: String = "/container",
+    title: String = "Container",
+    children: Array<Track>? = null,
+    imageRow: Array<ImageRowItem>? = null,
+  ) =
+    ResolvedTrack(
+      url = url,
+      children = children,
+      carPlaySiriListButton = null,
+      id = null,
+      src = null,
+      artwork = null,
+      artworkSource = null,
+      request = null,
+      artworkCarPlayTinted = null,
+      title = title,
+      subtitle = null,
+      artist = null,
+      albumUrl = null,
+      album = null,
+      description = null,
+      genre = null,
+      duration = null,
+      style = null,
+      childrenStyle = null,
+      favorited = null,
+      groupTitle = null,
+      live = null,
+      imageRow = imageRow,
+    )
+
+  /**
+   * A route serving [browseStatic] verbatim. `browseStatic` is the only one of the three browse
+   * arms (callback > config > static) that needs neither the JNI bridge nor HTTP, so it is how a
+   * unit test gives [com.audiobrowser.browser.BrowserManager] page content to resolve.
+   */
+  fun staticRoute(path: String, browseStatic: ResolvedTrack) =
+    NativeRouteEntry(
+      path = path,
+      browseCallback = null,
+      browseConfig = null,
+      browseStatic = browseStatic,
+      searchCallback = null,
+      searchConfig = null,
+      media = null,
+      artwork = null,
+    )
+
   fun artworkConfig(
     path: String? = null,
     query: Map<String, String>? = null,

package/android/src/test/java/com/audiobrowser/browser/BrowserManagerLayerResolutionTest.kt

@@ -8,6 +8,8 @@ import org.junit.Assert.assertNull
 import org.junit.Assert.assertSame
 import org.junit.Before
 import org.junit.Test
+import org.junit.runner.RunWith
+import org.robolectric.RobolectricTestRunner
 
 /**
  * Tests the request/browse layer resolution + caching introduced for resolver thunks.
@@ -26,7 +28,11 @@ import org.junit.Test
  * bump, no in-flight cache) is identical for the static and resolver paths — `resolveLayer` only
  * differs in how it produces the `TransformableRequestConfig` — so the guard is fully covered here.
  * The resolver-await path is covered by the TS/web-stub tests and on iOS.
+ *
+ * Runs under Robolectric for [BrowserManager]'s `android.util.LruCache` fields: `clearContentCache`
+ * calls `evictAll()`, which a plain JVM test cannot execute.
  */
+@RunWith(RobolectricTestRunner::class)
 class BrowserManagerLayerResolutionTest {
 
   private lateinit var browserManager: BrowserManager